zlay's thread-per-PDS architecture (2,700 concurrent subscribers) allowed interleaving between seq assignment (under persist lock) and broadcast (unlocked), delivering frames out of order to consumers. adds broadcast_order mutex to Broadcaster — subscriber threads now hold it across persist → resequence → broadcast, matching Indigo's pattern of serializing the entire pipeline through one lock. also fixes the error fallback that broadcast with upstream seq on persist failure (mixing sequence domains). now drops the frame instead. includes regression test that spawns 8 threads doing concurrent broadcast and verifies monotonic output. confirmed: test catches the bug when the lock is removed (seq 3 after 4). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>